Weaknesses of type CWE-79

30,295 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2024-8907MEDIUMInsufficient data validation in Omnibox in Google Chrome on Android prior to 129.0.6668.58 allowed a remote attacker who convinced a user toEPSS 0.3%CVE-2024-37944MEDIUMWordPress WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin <= 5.9.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-105643HIGHGhost: Stored XSS via Embed Card PreviewsEPSS 0.3%CVE-2024-44062MEDIUMWordPress Custom Field Template plugin <= 2.6.5 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-47396MEDIUMWordPress Move Addons for Elementor plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-50740MEDIUMAutoConnect 1.4.2, an Arduino library, is vulnerable to a cross site scripting (xss) vulnerability. The AutoConnect web interface /_ac/confiEPSS 0.3%CVE-2025-10467HIGHStored XSS in Proliz Software's OBSEPSS 0.3%CVE-2026-4305MEDIUMRoyal WordPress Backup & Restore Plugin <= 1.0.16 - Reflected Cross-Site Scripting via 'wpr_pending_template' ParameterEPSS 0.3%CVE-2024-50445MEDIUMWordPress Selection Lite plugin <= 1.13 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-33977HIGHCross-site Scripting in Janobe E-Negosyo SystemEPSS 0.3%CVE-2025-47623MEDIUMWordPress Easy PayPal Buy Now Button plugin <= 2.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2024-47872MEDIUMCross-site Scripting on Gradio server via upload of HTML files, JS files, or SVG filesEPSS 0.3%CVE-2025-27108HIGHCross-site Scripting vulnerability due to improper use of string.replace in dom-expressionsEPSS 0.3%CVE-2024-50433MEDIUMWordPress Sky Addons for Elementor plugin <= 2.5.15 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-5413HIGHCross-Site Scripting (XSS) vulnerability on PhpMyBackupProEPSS 0.3%CVE-2024-47329MEDIUMWordPress ElementsReady Addons for Elementor plugin <= 6.4.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-37553MEDIUMWordPress Testimonials Widget plugin <= 4.0.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-107845CRITICALContao: Cross-site scripting in the comments bundleEPSS 0.3%CVE-2026-53693MEDIUMMISP BSimVis stored cross-site scripting in tag and cluster rendering paths via unescaped tag metadata and UI labelsEPSS 0.3%CVE-2024-37460MEDIUMWordPress SuperSaaS – online appointment scheduling plugin <= 2.1.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%